Token-spraying attacks hit Microsoft 365 accounts

Huntress uncovered a global BEC campaign targeting Microsoft 365 with adversary-in-the-middle phishing and stolen session tokens. Between July and September 2026 researchers logged at least 200,000 sign-in attempts, 497 of which succeeded.

• At least 200,000 sign-in attempts, 497 successful
• Campaign hit 79 Huntress customers from July to September 2026
• Attackers wiped MFA settings and added their own phones
• Conditional Access and session revocation recommended